CVE-2026-54593
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSummary
CVE-2026-54593 is a high-severity Improper Restriction of Security Token Assignment (CWE-1259) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-49880
Vulnerability Data
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose;…
more
because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
A tamperproof reference monitor ensures security tokens cannot be improperly assigned or altered outside policy.
Access enforcement directly requires that security tokens used for authorization decisions are protected from unauthorized assignment or modification.
Developer testing and evaluation can discover flaws that produce incorrect security tokens before deployment.
Isolating security functions from non-security functions reduces the attack surface for tampering with token assignment logic.
Security attributes (tokens) must be associated and maintained with subjects/objects, which structurally prevents improper assignment or lack of protection.
Requiring documented, secure development processes and tools reduces the chance of implementing faulty token-generation logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Verification of identity assertions can detect incorrect tokens but does not prevent flawed generation logic.
Proper definition and enforcement of authorizations directly addresses improper security token restrictions.
Secure SDLC practices directly reduce the chance of implementing incorrect token generation.
Pre-acquisition hardware integrity checks can detect flawed token protection mechanisms before deployment.
Logical access protections can prevent exploitation of improperly assigned hardware security tokens.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged access rights help ensure only authorized processes can assign or modify tokens.
Security testing can detect improper token assignment but does not prevent it at design time.
Information access restriction directly limits which entities can obtain or use security tokens.
Proper use of cryptography ensures tokens are generated with correct algorithms, keys and entropy.
Secure development lifecycle practices include requirements and reviews that prevent flawed token-generation logic.
Application security requirements explicitly call for correct token issuance and validation mechanisms.